Companies running web sites often have good reason to try and ascertain the physical location (or geolocation) of the user accessing their sites. Such geolocation information is useful for purposes such as marketing (e.g. to better target offers or advertisements) as well as fraud detection (e.g. if a user who normally checks their bank account from Wichita, Kans. is found to be logging in from East Europe, it might be reason enough for the bank to track the user's activities on the web site carefully).
When a user accesses a web site the only piece of information the web site knows is the user's origin IP address. To get from an IP address to a physical address requires the use of a technology known as IP geolocation. Ranges of IP addresses are assigned to Internet Service Providers who then make them available to end customers in different locales. For instance, the range 149.141.x.x might currently be in use by a particular ISP who is using that range in Alexandria, Va. IP geolocation technology essentially provides a reverse lookup on a database of a physical location given an IP address. The database is maintained by determining which ranges are in use in which locales and then updating the database as changes occur. IP geolocation has two significant shortcomings. First, the database underlying the reverse look-up is largely static and has to be manually updated which can result in errors. Perhaps more critical is the second shortcoming in that IP geolocation identifies a user very precisely and ties them to a particular PC. For most uses of IP geolocation it is usually sufficient for a web site to know that the user is currently located, for example, in Alexandria, Va. Knowing that they are precisely at IP address 141.149 0.1.1, and storing that information, is a needless violation of the user's privacy and in general storing personally identifiable data, especially when not required, is a needless increase in costs and potential liability to the web site.
An alternate method already prevalent in smartphones, and some computers, is to have a program on the phone to report the GPS coordinates of the user. Such GPS systems also provide more precise location data than is needed in most cases, and moreover cannot necessarily be used for fraud detection. This is because the GPS coordinates are self-reported by the software on the smartphone and consequently can fairly easily be thwarted by an attacker.
The innovation described herein provides a new method of IP geolocation that is both more secure (more difficult for an attacker to mislead) and provides more privacy to the user.